Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados

40.553CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.327 exploits

Referência

CVE-2026-15377

CVE-2026-15377MEDIUM

Eleveo Call Recording Software sendlogfile improper authorization

33RIESGO

abrir ↗

Referência

CVE-2020-5902

CVE-2020-5902CRITICALbajo ataqueransomware

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RIESGO

abrir ↗

Referência

CVE-2026-15375

CVE-2026-15375MEDIUM

Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization

33RIESGO

abrir ↗

Referência

CVE-2026-14757

CVE-2026-14757MEDIUM

radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow

33RIESGO

abrir ↗

Referência

CVE-2026-14735

CVE-2026-14735MEDIUM

code-projects Smart Parking System parkings.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-108894

CVE-2026-108894CRITICAL

Linksys E1700 Static Route addStaticRoute os command injection

48RIESGO

abrir ↗

Referência

CVE-2026-108893

CVE-2026-108893CRITICAL

Linksys E1700 setVlan stack-based overflow

48RIESGO

abrir ↗

Referência

CVE-2026-108892

CVE-2026-108892CRITICAL

Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow

48RIESGO

abrir ↗

Referência

CVE-2020-9374

CVE-2020-9374—

On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploit

35RIESGO

abrir ↗

Referência

CVE-2026-108813

CVE-2026-108813MEDIUM

SEMCMS SEMCMS_Download.php sql injection

33RIESGO

abrir ↗

Referência✓ VexDay Proof

TaskTracker 1.5 - 'Customize.asp' Remote Add Administrator

CVE-2007-0049—webappsasp

Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add act

23RIESGO

abrir ↗

Referência

CVE-2026-108812

CVE-2026-108812MEDIUM

SEMCMS SEMCMS_User.php user improper authorization

33RIESGO

abrir ↗

Referência

CVE-2026-108963

CVE-2026-108963HIGH

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a data

41RIESGO

abrir ↗

Referência

CVE-2026-108768

CVE-2026-108768MEDIUM

zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources

33RIESGO

abrir ↗

Referência✓ VexDay Proof

AutoDealer 2.0 - 'detail.asp?iPro' SQL Injection

CVE-2007-0053—webappsasp

SQL injection vulnerability in detail.asp in ASP SiteWare autoDealer 2.0 and earlier allows remote attackers to execute

23RIESGO

abrir ↗

Referência

CVE-2013-6232

CVE-2013-6232—

Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web

23RIESGO

abrir ↗

Referência

CVE-2013-6236

CVE-2013-6236—

IZON IP 2.0.2: hard-coded password vulnerability

28RIESGO

abrir ↗

Referência

CVE-2026-109175

CVE-2026-109175MEDIUM

MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList

33RIESGO

abrir ↗

Referência

CVE-2026-109166

CVE-2026-109166HIGH

lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById

41RIESGO

abrir ↗

Referência

CVE-2026-109165

CVE-2026-109165MEDIUM

TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create

33RIESGO

abrir ↗

Referência

CVE-2026-108827

CVE-2026-108827LOW

Zen Cart Administrative Module Management general.php zen_call_function code injection

28RIESGO

abrir ↗

Referência

CVE-2026-108878

CVE-2026-108878MEDIUM

JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById

33RIESGO

abrir ↗

Referência

CVE-2019-6272

CVE-2019-6272—

Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attacker

28RIESGO

abrir ↗

Referência

CVE-2026-94295

CVE-2026-94295MEDIUM

Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature

33RIESGO

abrir ↗

Referência

CVE-2026-76556

CVE-2026-76556MEDIUM

WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules

33RIESGO

abrir ↗

Referência

CVE-2026-80072

CVE-2026-80072MEDIUM

User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters

33RIESGO

abrir ↗

Referência

CVE-2026-86780

CVE-2026-86780MEDIUM

Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text

33RIESGO

abrir ↗

Referência

CVE-2026-78151

CVE-2026-78151MEDIUM

FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response

33RIESGO

abrir ↗

Referência

CVE-2026-77788

CVE-2026-77788MEDIUM

Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas

33RIESGO

abrir ↗

Referência

CVE-2026-82631

CVE-2026-82631LOW

valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free

28RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.